Azure gives you strong security tools, but the defaults and the sheer number of knobs make it easy to leave a door open. These seven mistakes account for a large share of real-world Azure incidents — check your environment against them.
1. Storage Accounts Open to the Public Internet
A storage account with public network access and anonymous blob access is a data leak waiting to happen. Lock it to a virtual network or private endpoint and disable anonymous access:
az storage account update --name myappstorage \ --resource-group my-rg --public-network-access Disabled
2. Overusing the Owner Role
Handing out Owner at subscription scope is the Azure equivalent of giving everyone root. Use the least-privileged built-in role that fits, scoped to a resource group rather than the whole subscription.
3. Secrets in App Settings Instead of Key Vault
Connection strings and API keys pasted into app settings end up in exports and logs. Store them in Key Vault and reference them:
@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/db-conn/)
4. Network Security Groups Open to 0.0.0.0/0
An NSG rule allowing RDP or SSH from any source is scanned and attacked within minutes. Restrict management ports to known IPs or use Bastion instead of exposing them at all.
5. No Multi-Factor Authentication
An account without MFA is one phished password away from compromise. Enforce MFA via Conditional Access for every user, and especially for admins.
6. Ignoring Microsoft Defender for Cloud
Defender for Cloud continuously scores your posture and flags exactly these issues. Leaving it off means flying blind past warnings you would have wanted:
az security pricing create --name VirtualMachines --tier Standard
7. Long-Lived Service Principal Secrets
Service principal client secrets that never rotate become permanent keys. Prefer managed identities, which Azure rotates for you and never exposes as a downloadable secret.
Summary
Azure security failures cluster around the same handful of mistakes: public storage, over-broad Owner grants, secrets outside Key Vault, wide-open NSGs, missing MFA, ignored Defender findings, and stale service principal secrets. None of the fixes are hard — most are a single setting or a managed identity away. Walk your environment through this list and you close the doors attackers actually use.